Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Webmin ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen oder einen Cross-Site-Scripting Angriff durchzuführen.
Product
Webmin ist eine modulare Webanwendung zur Administration eines Unix-basierenden Systems und zur Konfiguration einzelner Dienste.
Vulnerabilities 2
-
High 7.2
Webmin through 2.670 OS Command Injection via Samba User Account Options
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags pa…
-
Medium 5.4
Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View
Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containin…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-Q3XP-JR54-J7GW vom 2026-11-09
https://github.com/advisories/GHSA-Q3XP-JR54-J7GW
-
GitHub Security Advisory GHSA-wc4p-j42q-3r22 vom 2026-11-09
https://github.com/advisories/GHSA-wc4p-j42q-3r22